CVE-2026-7071-access-Control

CodeAstro 在线求职门户（PHP MySQL）中的未认证简历泄露 详细信息 供应商： CodeAstro 产品： 基于 PHP MySQL 的在线求职门户项目 版本： 1.0 漏洞类型： 访问控制不当 / 信息泄露 CWE： CWE-284、CWE-200、CWE-548 受影响端点： /users/user-cvs/ 影响： 未认证即可访问所有用户简历 描述 该应用程序将用户简历存储在公开可访问的目录（/users/user-cvs/）中，未强制执行身份验证或授权检查。 未认证的攻击者可以通过请求文件 URL 直接访问并下载任何用户的简历。...

EUVD-2025-31031

Malicious code in bioql PyPI...

CVE-2025-48869 Horilla Unauthorized Access to Candidate Resume Files Due to Broken Access Control

Horilla is a free and open source Human Resource Management System HRMS. Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive...

PT-2025-39308

Name of the Vulnerable Software and Affected Versions Horilla version 1.3.0 Description Horilla is a Human Resource Management System HRMS. Unauthenticated users can access uploaded resume files by directly guessing or predicting file URLs. These files are stored in a publicly accessible director...

CVE-2022-2544

The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes...